explore paranoia action

.github/workflows/security.yml

@@ -1,8 +1,10 @@
+name: Security
 on:
   pull_request:
     types: [opened]
   push:
-name: Security
+env:
+  CONTAINER_TAR: "container.tar"
 jobs:
   gosec:
     runs-on: ubuntu-latest
@@ -12,4 +14,21 @@ jobs:
       - name: Run Gosec Security Scanner
         uses: securego/gosec@master
         with:
-          args: ./...
+          args: ./...
+  paranoia:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Source
+        uses: actions/checkout@v3
+      - name: "Build container"
+        run: |
+          docker build -t rond-security-check .
+      - name: "Save container to tar"
+        run: |
+          docker save rond-security-check > $CONTAINER_TAR
+      - name: Jetstack Paranoia
+        uses: jetstack/paranoia@v0.2.1
+        with:
+          config: .paranoia.yml
+          permissive: true # TODO: understand actually needed certificate and make this false
+          target_tar: file://${{ env.CONTAINER_TAR }}

.paranoia.yml

@@ -0,0 +1,2 @@
+version: "1"
+allow: